🛎️ Windows Service Canary

Decoy Windows services named like the backup, security and database services ransomware stops first.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Install lightweight services named like the backup agents, security tools and databases that ransomware stops before it encrypts. Nothing legitimate stops them outside a shutdown, so a stop, especially several at once, is an early ransomware signal that fires before encryption begins.

Implementation requirements

Several small services named like targets on ransomware stop lists (backup agents, database servers, security tools), set to start automatically
Alert on any stop or disable of a decoy service outside a planned shutdown
Optional response, as in NCC Group's prototype: the canaries watch each other and isolate or hibernate the host when several stop together
Safety: the services do nothing and hold no credentials; test any automatic response so it cannot disrupt production
Rollback: Stop and uninstall the services, then remove their alert rule.
Upkeep: Keep names in step with the products ransomware tends to stop. Check they still start after patching.

Cost

Negligible.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

Windows

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1685 Disable or Modify Tools	Defense Impairment	theoretical	moderate
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Deception Engineering: exploring the use of Windows Service Canaries against ransomware — Prototype Windows service canaries: decoy services that ransomware stops before encrypting; several stopping together triggers the alert. Not tested against live ransomware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1685 Disable or Modify Tools as an adversary behaviour. Logging management events — AWS CloudTrail User Guide — Disabling or deleting a decoy alarm or log group is a logged management event.
T1489 Service Stop	Impact	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Deception Engineering: exploring the use of Windows Service Canaries against ransomware — Prototype Windows service canaries: decoy services that ransomware stops before encrypting; several stopping together triggers the alert. Not tested against live ransomware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1489 Service Stop as an adversary behaviour. Moderate: the service canary is a published prototype, not yet tested against live ransomware.

Evidence

Deception Engineering: exploring the use of Windows Service Canaries against ransomware — Whitehouse, O., NCC Group 2021 industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Whitehouse (NCC Group, 2021) prototypes Windows service canaries against ransomware; the author notes it has not been tested against live ransomware. Stopping services before encryption is documented ransomware behaviour (ATT&CK T1489).